GitHub Advisoryadvisory · PyPI

GHSA-w4px-9pgm-p2f3 pyrad uses sequential packet IDs

MEDIUM Published 2022-05-05 Modified 2024-10-24 Official page ↗
Aliases
CVE-2013-0342
Ecosystem
PyPI
Packages
pyrad
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-20
Reviewed
2024-04-29

Affected packages

• PyPI pyrad: < 2.1 → fixed in 2.1

Description

The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packets by predicting the next ID, a different vulnerability than CVE-2013-0294.

Related

Alias · CVE (1)

  • CVE-2013-0342 The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References